<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[214378] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/214378">214378</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2017-03-24 14:46:07 -0700 (Fri, 24 Mar 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Handle recursive calls to ProcessingInstruction::checkStyleSheet
https://bugs.webkit.org/show_bug.cgi?id=169982
<rdar://problem/31083051>
Reviewed by Antti Koivisto.
Source/WebCore:
See if we triggered a recursive load of the stylesheet during the 'beforeload'
event handler. If so, reset to a valid state before completing the load.
We should also check after 'beforeload' that we were not disconnected from (or
moved to a new) document.
I also looked for other cases of this pattern and fixed them, too.
Tests: fast/dom/beforeload/image-removed-during-before-load.html
fast/dom/beforeload/recursive-css-pi-before-load.html
fast/dom/beforeload/recursive-link-before-load.html
fast/dom/beforeload/recursive-xsl-pi-before-load.html
* dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::clearExistingCachedSheet): Added.
(WebCore::ProcessingInstruction::checkStyleSheet): Prevent recursive calls into
this function during 'beforeload' handling. Also, safely handle the case where
the element was disconnected in the 'beforeload' handler (similar to what
we do in HTMLLinkElement).
(WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
current document to match what we do in setXSLStyleSheet.
* dom/ProcessingInstruction.h:
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::process): Prevent recursive calls into
this function during 'beforeload' handling.
* html/HTMLLinkElement.h:
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): safely handle the case where
the element was disconnected in the 'beforeload' handler (similar to what
we do in HTMLLinkElement).
* style/StyleScope.cpp:
(WebCore::Style::Scope::hasPendingSheet): Added.
* style/StyleScope.h:
LayoutTests:
* fast/dom/beforeload/image-removed-during-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt.
* fast/dom/beforeload/image-removed-during-before-load.html: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html.
* fast/dom/beforeload/recursive-css-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt.
* fast/dom/beforeload/recursive-css-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html.
* fast/dom/beforeload/recursive-link-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt.
* fast/dom/beforeload/recursive-link-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load.html.
* fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt.
* fast/dom/beforeload/recursive-xsl-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html.
* fast/dom/beforeload/resources/content.xhtml: Copied from LayoutTests/fast/dom/beforeload/resources/content.xhtml.
* fast/dom/beforeload/resources/pass.css: Copied from LayoutTests/fast/dom/beforeload/resources/pass.css.
* fast/dom/beforeload/resources/test.xsl: Copied from LayoutTests/fast/dom/beforeload/resources/test.xsl.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructioncpp">trunk/Source/WebCore/dom/ProcessingInstruction.cpp</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructionh">trunk/Source/WebCore/dom/ProcessingInstruction.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementcpp">trunk/Source/WebCore/html/HTMLLinkElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementh">trunk/Source/WebCore/html/HTMLLinkElement.h</a></li>
<li><a href="#trunkSourceWebCoreloaderImageLoadercpp">trunk/Source/WebCore/loader/ImageLoader.cpp</a></li>
<li><a href="#trunkSourceWebCorestyleStyleScopecpp">trunk/Source/WebCore/style/StyleScope.cpp</a></li>
<li><a href="#trunkSourceWebCorestyleStyleScopeh">trunk/Source/WebCore/style/StyleScope.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadexpectedtxt">trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadhtml">trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcescontentxhtml">trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcespasscss">trunk/LayoutTests/fast/dom/beforeload/resources/pass.css</a></li>
<li><a href="#trunkLayoutTestsfastdombeforeloadresourcestestxsl">trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/LayoutTests/ChangeLog 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2017-03-24 Brent Fulgham <bfulgham@apple.com>
+
+ Handle recursive calls to ProcessingInstruction::checkStyleSheet
+ https://bugs.webkit.org/show_bug.cgi?id=169982
+ <rdar://problem/31083051>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/dom/beforeload/image-removed-during-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt.
+ * fast/dom/beforeload/image-removed-during-before-load.html: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html.
+ * fast/dom/beforeload/recursive-css-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt.
+ * fast/dom/beforeload/recursive-css-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html.
+ * fast/dom/beforeload/recursive-link-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt.
+ * fast/dom/beforeload/recursive-link-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load.html.
+ * fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt.
+ * fast/dom/beforeload/recursive-xsl-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html.
+ * fast/dom/beforeload/resources/content.xhtml: Copied from LayoutTests/fast/dom/beforeload/resources/content.xhtml.
+ * fast/dom/beforeload/resources/pass.css: Copied from LayoutTests/fast/dom/beforeload/resources/pass.css.
+ * fast/dom/beforeload/resources/test.xsl: Copied from LayoutTests/fast/dom/beforeload/resources/test.xsl.
+
</ins><span class="cx"> 2017-03-24 Brady Eidson <beidson@apple.com>
</span><span class="cx">
</span><span class="cx"> A null compound index value crashes the Databases process.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadexpectedtxtfromrev214368trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadexpectedtxt"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+This test confirms that image loading properly handles a 'beforeload' events that removes the image from the document. It passes if no debug assertions are fired.
+
+PASS: Hit the beforeload handler
+PASS
+PASS: No assertions hit.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadhtmlfromrev214368trunkLayoutTestsfastdombeforeloadimageremovedduringbeforeloadhtml"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ image = document.createElement("img");
+ image.setAttribute("style", "display:none");
+ image.addEventListener("load", function() {
+ print('PASS', 'green');
+ }, { once: true });
+ image.addEventListener("beforeload", function() {
+ print('PASS: Hit the beforeload handler', 'green');
+ document.body.removeChild(image);
+ image = null;
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(image);
+
+ image.setAttribute("src", "../../images/resources/test-load.jpg");
+}
+
+function step2()
+{
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that image loading properly handles a 'beforeload' events that removes the image from the document. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadexpectedtxtfromrev214368trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadexpectedtxt"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+This test confirms that CSS stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadhtmlfromrev214368trunkLayoutTestsfastdombeforeloadrecursivecsspibeforeloadhtml"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ function step2(){
+ ins = 'href="pass.css" type="text/css"';
+ pi = frame.contentDocument.createProcessingInstruction('xml-stylesheet', ins);
+ pi.addEventListener("beforeload", function(){ pi.data = 'href="fail.css" type="text/css"'; }, { once: true });
+ frame.contentDocument.insertBefore(pi, frame.contentDocument.firstChild);
+
+ frame.contentDocument.removeChild(pi);
+ pi = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that CSS stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadexpectedtxtfromrev214368trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadexpectedtxt"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+This test confirms that link elements properly handled changes during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: Beforeload handled.
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadhtmlfromrev214368trunkLayoutTestsfastdombeforeloadrecursivelinkbeforeloadhtml"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-link-before-load.html 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,61 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ var link;
+ var head;
+
+ function step2() {
+ head = frame.contentDocument.getElementsByTagName('head')[0];
+
+ link = frame.contentDocument.createElement('link');
+ link.type = 'text/css';
+ link.rel = 'stylesheet';
+
+ link.addEventListener("beforeload", function() {
+ print("PASS: Beforeload handled.", "green");
+ link.href = 'fail.css';
+ setTimeout(step3, 0);
+ }, { once: true });
+
+ link.href = 'pass.css';
+
+ head.appendChild(link);
+ }
+
+ function step3() {
+ head.removeChild(link);
+ link = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that link elements properly handled changes during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadexpectedtxtfromrev214368trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadexpectedtxt"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+This test confirms that XSL stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.
+
+PASS: No assertions hit.
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadhtmlfromrev214368trunkLayoutTestsfastdombeforeloadrecursivexslpibeforeloadhtml"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="pragma" content="no-cache"/>
+<meta http-equiv="expires" content="0"/>
+<script src="resources/print.js"></script>
+<script>
+function test()
+{
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ frame = document.createElement("iframe");
+ frame.setAttribute("src", "resources/content.xhtml");
+ frame.addEventListener("load", function(){
+ setTimeout(step2, 0);
+ }, { once: true });
+
+ document.body.appendChild(frame);
+
+ function step2(){
+ ins = 'href="test.xsl?a=1" type="text/xsl"';
+ pi = frame.contentDocument.createProcessingInstruction('xml-stylesheet', ins);
+ pi.addEventListener("beforeload", function(){ pi.data = 'href="test.xsl?b=1" type="text/xsl"'; }, { once: true });
+ frame.contentDocument.insertBefore(pi, frame.contentDocument.firstChild);
+
+ frame.contentDocument.removeChild(pi);
+ pi = null;
+
+ print("PASS: No assertions hit.", "green");
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+}
+</script>
+</head>
+<body onload="test()">
+<p>This test confirms that XSL stylesheets are properly handled if loaded during 'beforeload' events. It passes if no debug assertions are fired.</p>
+<div id="console"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcescontentxhtmlfromrev214368trunkLayoutTestsfastdombeforeloadresourcescontentxhtml"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/content.xhtml 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+hi
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcespasscssfromrev214368trunkLayoutTestsfastdombeforeloadresourcespasscss"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/resources/pass.css (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/resources/pass.css) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/pass.css (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/pass.css 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+.block {
+ width: 100px;
+ height: 100px;
+ background-color: green;
+}
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdombeforeloadresourcestestxslfromrev214368trunkLayoutTestsfastdombeforeloadresourcestestxsl"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl (from rev 214368, trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl) (0 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl (rev 0)
+++ trunk/LayoutTests/fast/dom/beforeload/resources/test.xsl 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:output method="html"/>
+ <xsl:template match="/">
+ <html>
+ <head>
+ </head>
+ <body>
+ Test
+ </body>
+ </html>
+ </xsl:template>
+</xsl:stylesheet>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/ChangeLog 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2017-03-24 Brent Fulgham <bfulgham@apple.com>
+
+ Handle recursive calls to ProcessingInstruction::checkStyleSheet
+ https://bugs.webkit.org/show_bug.cgi?id=169982
+ <rdar://problem/31083051>
+
+ Reviewed by Antti Koivisto.
+
+ See if we triggered a recursive load of the stylesheet during the 'beforeload'
+ event handler. If so, reset to a valid state before completing the load.
+
+ We should also check after 'beforeload' that we were not disconnected from (or
+ moved to a new) document.
+
+ I also looked for other cases of this pattern and fixed them, too.
+
+ Tests: fast/dom/beforeload/image-removed-during-before-load.html
+ fast/dom/beforeload/recursive-css-pi-before-load.html
+ fast/dom/beforeload/recursive-link-before-load.html
+ fast/dom/beforeload/recursive-xsl-pi-before-load.html
+
+ * dom/ProcessingInstruction.cpp:
+ (WebCore::ProcessingInstruction::clearExistingCachedSheet): Added.
+ (WebCore::ProcessingInstruction::checkStyleSheet): Prevent recursive calls into
+ this function during 'beforeload' handling. Also, safely handle the case where
+ the element was disconnected in the 'beforeload' handler (similar to what
+ we do in HTMLLinkElement).
+ (WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
+ current document to match what we do in setXSLStyleSheet.
+ * dom/ProcessingInstruction.h:
+ * html/HTMLLinkElement.cpp:
+ (WebCore::HTMLLinkElement::process): Prevent recursive calls into
+ this function during 'beforeload' handling.
+ * html/HTMLLinkElement.h:
+ * loader/ImageLoader.cpp:
+ (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): safely handle the case where
+ the element was disconnected in the 'beforeload' handler (similar to what
+ we do in HTMLLinkElement).
+ * style/StyleScope.cpp:
+ (WebCore::Style::Scope::hasPendingSheet): Added.
+ * style/StyleScope.h:
+
</ins><span class="cx"> 2017-03-24 Brady Eidson <beidson@apple.com>
</span><span class="cx">
</span><span class="cx"> A null compound index value crashes the Databases process.
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.cpp (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.cpp 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.cpp 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2000 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include "StyleSheetContents.h"
</span><span class="cx"> #include "XMLDocumentParser.h"
</span><span class="cx"> #include "XSLStyleSheet.h"
</span><ins>+#include <wtf/SetForScope.h>
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="lines">@@ -80,6 +81,10 @@
</span><span class="cx">
</span><span class="cx"> void ProcessingInstruction::checkStyleSheet()
</span><span class="cx"> {
</span><ins>+ // Prevent recursive loading of stylesheet.
+ if (m_isHandlingBeforeLoad)
+ return;
+
</ins><span class="cx"> if (m_target == "xml-stylesheet" && document().frame() && parentNode() == &document()) {
</span><span class="cx"> // see http://www.w3.org/TR/xml-stylesheet/
</span><span class="cx"> // ### support stylesheet included in a fragment of this (or another) document
</span><span class="lines">@@ -134,13 +139,25 @@
</span><span class="cx"> document().styleScope().removePendingSheet(*this);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ Ref<Document> originalDocument = document();
+
</ins><span class="cx"> String url = document().completeURL(href).string();
</span><ins>+
+ {
+ SetForScope<bool> change(m_isHandlingBeforeLoad, true);
</ins><span class="cx"> if (!dispatchBeforeLoadEvent(url))
</span><span class="cx"> return;
</span><ins>+ }
</ins><span class="cx">
</span><ins>+ bool didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement)
+ return;
+
</ins><span class="cx"> m_loading = true;
</span><span class="cx"> document().styleScope().addPendingSheet(*this);
</span><span class="cx">
</span><ins>+ ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
+
</ins><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> if (m_isXSL) {
</span><span class="cx"> auto options = CachedResourceLoader::defaultCachedResourceOptions();
</span><span class="lines">@@ -181,7 +198,8 @@
</span><span class="cx"> bool ProcessingInstruction::sheetLoaded()
</span><span class="cx"> {
</span><span class="cx"> if (!isLoading()) {
</span><del>- document().styleScope().removePendingSheet(*this);
</del><ins>+ if (document().styleScope().hasPendingSheet(*this))
+ document().styleScope().removePendingSheet(*this);
</ins><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> if (m_isXSL)
</span><span class="cx"> document().styleScope().flushPendingUpdate();
</span><span class="lines">@@ -211,6 +229,7 @@
</span><span class="cx"> // We don't need the cross-origin security check here because we are
</span><span class="cx"> // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
</span><span class="cx"> // type.
</span><ins>+ Ref<Document> protect(document());
</ins><span class="cx"> parseStyleSheet(sheet->sheetText());
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.h (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.h 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.h 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2000 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2006 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -74,6 +74,8 @@
</span><span class="cx">
</span><span class="cx"> void parseStyleSheet(const String& sheet);
</span><span class="cx">
</span><ins>+ void clearExistingCachedSheet();
+
</ins><span class="cx"> String m_target;
</span><span class="cx"> String m_localHref;
</span><span class="cx"> String m_title;
</span><span class="lines">@@ -87,6 +89,7 @@
</span><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> bool m_isXSL { false };
</span><span class="cx"> #endif
</span><ins>+ bool m_isHandlingBeforeLoad { false };
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.cpp (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -2,7 +2,7 @@
</span><span class="cx"> * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><del>- * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
</span><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="cx"> *
</span><span class="lines">@@ -55,6 +55,7 @@
</span><span class="cx"> #include "StyleScope.h"
</span><span class="cx"> #include "StyleSheetContents.h"
</span><span class="cx"> #include <wtf/Ref.h>
</span><ins>+#include <wtf/SetForScope.h>
</ins><span class="cx"> #include <wtf/StdLibExtras.h>
</span><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="lines">@@ -224,6 +225,10 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Prevent recursive loading of link.
+ if (m_isHandlingBeforeLoad)
+ return;
+
</ins><span class="cx"> URL url = getNonEmptyURLAttribute(hrefAttr);
</span><span class="cx">
</span><span class="cx"> if (!m_linkLoader.loadLink(m_relAttribute, url, attributeWithoutSynchronization(asAttr), attributeWithoutSynchronization(crossoriginAttr), document()))
</span><span class="lines">@@ -243,8 +248,11 @@
</span><span class="cx"> m_cachedSheet = nullptr;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ {
+ SetForScope<bool> change(m_isHandlingBeforeLoad, true);
</ins><span class="cx"> if (!shouldLoadLink())
</span><span class="cx"> return;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> m_loading = true;
</span><span class="cx">
</span><span class="lines">@@ -277,6 +285,7 @@
</span><span class="cx">
</span><span class="cx"> request.setAsPotentiallyCrossOrigin(crossOrigin(), document());
</span><span class="cx">
</span><ins>+ ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
</ins><span class="cx"> m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
</span><span class="cx">
</span><span class="cx"> if (m_cachedSheet)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.h (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.h 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/html/HTMLLinkElement.h 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><del>- * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -132,6 +132,7 @@
</span><span class="cx"> bool m_createdByParser;
</span><span class="cx"> bool m_firedLoad;
</span><span class="cx"> bool m_loadedResource;
</span><ins>+ bool m_isHandlingBeforeLoad { false };
</ins><span class="cx">
</span><span class="cx"> PendingSheetType m_pendingSheetType;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderImageLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ImageLoader.cpp (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ImageLoader.cpp 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/loader/ImageLoader.cpp 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -394,7 +394,12 @@
</span><span class="cx"> if (!element().document().hasLivingRenderTree())
</span><span class="cx"> return;
</span><span class="cx"> m_hasPendingBeforeLoadEvent = false;
</span><ins>+ Ref<Document> originalDocument = element().document();
</ins><span class="cx"> if (element().dispatchBeforeLoadEvent(m_image->url())) {
</span><ins>+ bool didEventListenerDisconnectThisElement = !element().isConnected() || &element().document() != originalDocument.ptr();
+ if (didEventListenerDisconnectThisElement)
+ return;
+
</ins><span class="cx"> updateRenderer();
</span><span class="cx"> return;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorestyleStyleScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/style/StyleScope.cpp (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/style/StyleScope.cpp 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/style/StyleScope.cpp 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><span class="cx"> * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
</span><del>- * Copyright (C) 2004-2009, 2011-2012, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2009, 2011-2012, 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
</span><span class="cx"> * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
</span><span class="cx"> * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
</span><span class="lines">@@ -233,6 +233,11 @@
</span><span class="cx"> return m_elementsInBodyWithPendingSheets.contains(&element);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool Scope::hasPendingSheet(const ProcessingInstruction& processingInstruction) const
+{
+ return m_processingInstructionsWithPendingSheets.contains(&processingInstruction);
+}
+
</ins><span class="cx"> void Scope::addStyleSheetCandidateNode(Node& node, bool createdByParser)
</span><span class="cx"> {
</span><span class="cx"> if (!node.isConnected())
</span></span></pre></div>
<a id="trunkSourceWebCorestyleStyleScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/style/StyleScope.h (214377 => 214378)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/style/StyleScope.h 2017-03-24 21:23:59 UTC (rev 214377)
+++ trunk/Source/WebCore/style/StyleScope.h 2017-03-24 21:46:07 UTC (rev 214378)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> * (C) 1999 Antti Koivisto (koivisto@kde.org)
</span><span class="cx"> * (C) 2001 Dirk Mueller (mueller@kde.org)
</span><span class="cx"> * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
</span><del>- * Copyright (C) 2004-2010, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2010, 2012-2013, 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
</span><span class="cx"> * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
</span><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="lines">@@ -92,6 +92,7 @@
</span><span class="cx"> bool hasPendingSheetsInBody() const;
</span><span class="cx"> bool hasPendingSheet(const Element&) const;
</span><span class="cx"> bool hasPendingSheetInBody(const Element&) const;
</span><ins>+ bool hasPendingSheet(const ProcessingInstruction&) const;
</ins><span class="cx">
</span><span class="cx"> bool usesStyleBasedEditability() { return m_usesStyleBasedEditability; }
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>